Live › vulnerability › CVE-2026-67187
Go to dashboardNinja Forms before 3.15.4 fails to validate list-type form fields on the server, so anyone can submit crafted values that bypass CSV escaping. When an administrator opens an exported submissions file, spreadsheet formulas in those values can run.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 16:33 UTC. All times on this page are UTC.
Sites running Ninja Forms before 3.15.4 that accept public submissions on forms containing list-type fields (Checkbox List, Multi-Select List, Image List, Country, State). The risk lands on administrators who download and open the CSV export. Sites with no public forms, or only text-only forms, are less exposed.
No product ranges from the sources yet.
wp plugin get ninja-forms --field=version3.15.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.
This page as .md · .json · in your agent: get_signal("CVE-2026-67187")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.